CVE-2026-71430 Details

A denial-of-service vulnerability has been identified in node-re2, a Node.js library providing RE2 regular expression bindings. This issue affects versions through 1.25.0. The vulnerability arises in the WrappedRE2::Replace function, which improperly handles replacement results by passing them to V8 using ToLocalChecked without verifying for an empty MaybeLocal. This oversight occurs when the resulting string or buffer exceeds V8's maximum string length. When a global replace operation utilizes an output-amplifying replacement template, the result can increase quadratically with the input size. Once the output surpasses V8's maximum string length, the unchecked ToLocalChecked call leads to a fatal, uncatchable process abort, instead of throwing a catchable exception. The vulnerability can be exploited remotely and without authentication, causing a native process abort that cannot be contained by try/catch blocks or domains, effectively crashing the entire Node process or worker.

Upgrade to node-re2 version 1.25.1 or later, which includes the necessary fix. The update can be applied using the npm package manager.